{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/openai/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for OpenAI: OpenAI API",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/openai/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "OpenAI: OpenAI API"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = Uses sub-processors; names Cloudflare for the US and EU endpoints. Evidence snapshot sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = Up to 30 days in abuse monitoring logs, with listed exceptions. Evidence snapshot sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = Data residency controls, for eligible customers. Evidence snapshot sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Not by default. Evidence snapshot sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits = Rate limits by model, organization and project; usage tiers rise with credit purchases. Evidence snapshot sha256:850e5704abd712706740bd40223a26958bc4579dcb2fc0e361250d2b1a0ad81a; recorded 2026-11-03T00:00:00Z; valid from 2026-11-03."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention = Zero Data Retention, on approval. Evidence snapshot sha256:d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95; recorded 2026-10-24T00:00:00Z; valid from 2026-10-24."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications is recorded with no value (fact openai/certifications@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa is recorded with no value (fact openai/dpa@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in OpenAI's own words: \"OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.\" Source: https://developers.openai.com/api/docs/guides/your-data"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in OpenAI's own words: \"By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.\" Source: https://developers.openai.com/api/docs/guides/your-data"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in OpenAI's own words: \"Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.\" Source: https://developers.openai.com/api/docs/guides/your-data"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in OpenAI's own words: \"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).\" Source: https://developers.openai.com/api/docs/guides/your-data"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/usage_limits/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits, in OpenAI's own words: \"The three paid usage tiers are Build, Launch, and Grow. Your organization’s usage tier upgrades automatically as its total credit purchases reach each threshold.\" Source: https://developers.openai.com/api/docs/guides/rate-limits"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/zero_data_retention/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention, in OpenAI's own words: \"Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.\" Source: https://developers.openai.com/api/docs/guides/your-data"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/openai/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/openai/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}